search

mcuadros / go-syslog

Syslog server library for go.
http://godoc.org/gopkg.in/mcuadros/go-syslog.v2
MIT License
523 stars 143 forks source link

Automatic format detection #22

Closed abligh closed 9 years ago

abligh commented 9 years ago

Detect the format of incoming syslog packets automatically by using a format type of Automatic

This pull request closes Issue #20. It is necessary first to merge PullRequest #21 on which this is based.

This patch somewhat accidentally adds support for octet count framing (i.e. RFC6587 section 3.4.1) for RFC3164 syslog messages in addition to the currently supported RFC6587 syslog messages, if the automatic option is selected. This would appear useful.

This has been tested with all 8 combinations of UDP/TCP, RFC3164/RFC5424 message format, and both framing types specified by RFC6587 (i.e. s3.4.1 octet counting, and s3.4.2 non-transparent framing).

A version of util-linux that has been adapted to test these 8 options is here: https://github.com/abligh/util-linux/tree/RFC6587-octet-counting

Note that the RFC6587 'format' option as currently presented in fact selects RFC5424 format messages with RFC6587 s3.4.1 framing, whereas the RFC5424 'format' option selects RFC5424 format messages with RFC6587 s3.4.2 framing. IE the RFC6587 format option is somewhat confusingly named as it should be called RFC5482WithRFC6587OctetCounting or similar.

Signed-off-by: Alex Bligh alex@alex.org.uk

abligh commented 9 years ago

Note this is only failing the Travis CI build as Travis is running go get on the format packages, which is trying to retrieve the master version (i.e. without this commit), which doesn't have the Automatic type in, as it's added by this patch.

mcuadros commented 9 years ago

Can you create a tests for this format? Also will be great if you can create a example for the readme and a note in the format documentation about the performance impact, since the detect function is called on every entry. Right?

mcuadros commented 9 years ago

BTW the travis issue should be fixed now.

abligh commented 9 years ago

I'll have a look at the test. Performance impact should be completely minimal as it passes a slice by reference, works forward to examine up to a space (probably 5 byte reads) then compares a couple of things. It isn't doing a parse of each format.

On 15 Jul 2015, at 22:11, M�ximo Cuadros notifications@github.com wrote:

Can you create a tests for this format? Also will be great if you can create a example for the readme and a note in the format documentation about the performance impact, since the detect function is called on every entry. Right?

� Reply to this email directly or view it on GitHub.

Alex Bligh

abligh commented 9 years ago

Nope - Travis is failing for the same reason.

abligh commented 9 years ago

OK that's a test suite added for the automatic formatting, plus the docs added. It should pass Travis once the problem re the nested repo is fixed your end.

abligh commented 9 years ago

thanks!

On 16 Jul 2015, at 14:34, M�ximo Cuadros notifications@github.com wrote:

Merged #22.

� Reply to this email directly or view it on GitHub.

Alex Bligh